bara22 Privacy Policy

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information that identifies, or could reasonably be used to identify, a living individual — directly or in combination with other data held by bara22. This includes names, identity document numbers, email addresses, IP addresses, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, or deletion.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data. For the purposes of this Policy, bara22 is the Data Controller.
• "Data Processor" means any third party that processes Personal Data on behalf of bara22 under a contractual arrangement and in accordance with bara22's documented instructions.
• "KYC Data" means identity and address verification documents submitted by a Player in connection with the Know Your Customer verification process.
• "Cookies" means small text files stored on your device by the Platform to enable functionality, analytics, and session management.
• "Platform" means the bara22 website, mobile web interface, and associated digital services accessible at bara22.cam.
• "WIB" means Western Indonesia Time (UTC+7), the default time zone used for all data timestamps on the bara22 Platform.

bara22 acts as the Data Controller in respect of all Personal Data collected from Players and Platform visitors. As Data Controller, bara22 is responsible for determining why and how your Personal Data is used, and for ensuring that such use complies with applicable data protection standards.

If you have any questions about how we process your Personal Data, or wish to exercise any of your data rights as set out in Clause 11 of this Policy, you may contact our privacy team directly:

• Privacy Contact Email: [email protected]
• Subject Line for Privacy Requests: "Privacy Request — [Your Registered Name]"
• Response Commitment: We aim to acknowledge all privacy-related inquiries within five (5) business days and to provide a substantive response within thirty (30) calendar days of receipt.

bara22 collects the following categories of Personal Data, each serving a specific operational or compliance purpose:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data, except where identity document photographs incidentally contain such information as part of a government-issued document submitted for KYC purposes.

bara22 collects Personal Data through the following channels:

• Direct Submission: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal request, contacting customer support, or participating in a promotion.
• Automated Collection: Technical and behavioral data collected automatically when you access or use the Platform, including through cookies, server logs, and session analytics tools. See Clause 6 for full details on our use of cookies.
• Third-Party Sources: Identity verification data returned by our KYC service providers following document authentication. Payment confirmation data received from our banking and e-wallet payment partners (BCA, BRI, BNI, Mandiri, GoPay, OVO, DANA, ShopeePay, and LinkAja). Fraud and sanctions screening data from internationally recognized screening databases.
• Inferred Data: Where we reasonably derive information from other data we hold — for example, inferring a Player's general location from their registered city (Jakarta, Surabaya, Bandung, Bali, Medan, Yogyakarta, Semarang) for time-zone display purposes.

bara22 processes your Personal Data only where we have a valid legal basis for doing so. The following table sets out our primary processing activities, their purposes, and the corresponding legal basis:

Where we rely on consent as our legal basis (such as for marketing communications), you may withdraw that consent at any time by contacting our support team at [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

bara22 uses cookies and similar tracking technologies to operate the Platform effectively, ensure security, and understand how Players interact with our services. By continuing to use the Platform, you consent to our use of cookies as described in this clause.

We use the following categories of cookies:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They manage your login session, maintain your Wallet Balance display, and enable security features such as CSRF protection. These cookies cannot be disabled without disrupting Platform functionality.
• Analytics Cookies: These cookies collect aggregated, anonymized data about how Players navigate the Platform — which pages are visited most frequently, how long sessions last, and where navigation errors occur. This data is used exclusively to improve Platform performance and user experience.
• Functional Cookies: These cookies remember your preferences — such as your preferred language display, time-zone setting (defaulting to WIB), and notification preferences — so you do not need to re-enter them each session.
• Fraud Detection Cookies: These cookies assist our fraud prevention systems by generating a device fingerprint that helps identify unusual login patterns or the presence of duplicate accounts linked to a single device.

bara22 does not use third-party advertising cookies or behavioral tracking cookies for cross-site advertising purposes. You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies may impair your ability to log in and use Platform features.

bara22 does not sell your Personal Data. We share your data only in the following limited circumstances, and only to the extent necessary for each stated purpose:

• Payment Service Providers: We share your financial and identity data with our banking and e-wallet partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, GoPay, OVO, DANA, ShopeePay, LinkAja) solely for the purpose of processing your deposits and withdrawals. These providers act as Data Processors under contractual data processing agreements with bara22.
• KYC and Identity Verification Providers: We share your submitted KYC documents with contracted identity verification service providers for the purpose of authenticating your identity and performing sanctions and politically exposed person (PEP) screening. These providers process your data exclusively on our instructions.
• Game Studio Technology Partners: Game session data (bet amounts, game outcomes) is shared with our game studio partners — including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft — to the extent necessary to operate the relevant games. These studios do not receive your full identity or financial details.
• Fraud Prevention and Security Services: Anonymized or pseudonymized technical data (IP addresses, device fingerprints) may be shared with specialized fraud detection and cybersecurity services to protect the Platform and all Players from unauthorized activity.
• Legal and Regulatory Authorities: We may disclose your Personal Data to law enforcement agencies, regulatory bodies, or courts where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of bara22, its Players, or the public.
• Corporate Restructuring: In the event of a merger, acquisition, or sale of substantially all of bara22's assets, your Personal Data may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections being maintained.

All third parties who receive your Personal Data from bara22 are contractually required to maintain appropriate technical and organizational security measures and to process your data only for the purposes for which it was shared.

The bara22 Platform serves Players primarily located in Indonesia. However, some of our technology infrastructure, cloud hosting services, and third-party Data Processors may be located in jurisdictions outside Indonesia. Where your Personal Data is transferred to, or processed in, a country outside Indonesia, bara22 takes steps to ensure that equivalent levels of protection are maintained.

These safeguards may include:

• Contractual clauses in agreements with Data Processors that require them to protect your data to a standard equivalent to or exceeding that required by applicable data protection law.
• Selecting third-party service providers that are certified under internationally recognized data security frameworks.
• Ensuring that transfers to jurisdictions with lower baseline data protection standards are subject to supplementary technical measures, such as encryption in transit and at rest.

If you would like further information about the specific safeguards we have in place for international data transfers, please contact us at [email protected].

bara22 retains your Personal Data for no longer than is necessary for the purposes for which it was collected, or to meet applicable legal, regulatory, or contractual obligations. Our standard retention periods by data category are as follows:

• Account and Identity Data: Retained for the duration of your active account, plus a minimum of five (5) years following permanent account closure to meet anti-money laundering and financial record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years following your last verified transaction, in accordance with financial compliance obligations. Document image files are deleted on a rolling basis once they are no longer needed for active verification purposes, subject to the minimum retention period.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, for tax, audit, and anti-money laundering compliance purposes.
• Behavioral and Betting Data: Retained for the duration of your active account, and for up to two (2) years following account closure for responsible gaming monitoring, dispute resolution, and fraud analysis purposes.
• Communications Data (Support Transcripts): Retained for up to two (2) years from the date of each interaction, or longer if the communication relates to an ongoing dispute or legal matter.
• Technical and Session Data: Retained for up to twelve (12) months from the date of collection, after which it is aggregated and anonymized for analytics purposes or deleted.
• Marketing Preferences: Retained until you withdraw your consent to receive marketing communications, at which point your preference is updated immediately and marketing data is purged within thirty (30) days.

At the end of any applicable retention period, Personal Data is securely deleted or irreversibly anonymized so that it can no longer be associated with any identifiable individual.

bara22 employs a layered set of technical and organizational security measures designed to protect your Personal Data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption: All data in transit between your device and our servers is protected using TLS 1.2 or higher (256-bit SSL). Sensitive data fields in our databases — including identity document references and financial account details — are encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to systems that hold Personal Data is restricted to bara22 personnel and contractors who have a documented need for such access. All access is subject to role-based permissions, multi-factor authentication, and regular access review audits.
• Penetration Testing: Our Platform undergoes regular security assessments and penetration tests conducted by qualified independent security professionals to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: bara22 maintains a documented data breach response plan. In the event of a security incident that compromises your Personal Data, we will notify affected Players and relevant authorities within the timeframes required by applicable law.
• Staff Training: All bara22 staff and contractors who handle Personal Data receive regular data protection and security awareness training as a condition of their engagement.

While we take every reasonable precaution to protect your data, no digital system is entirely immune to risk. You can help protect your own account by using a strong, unique password, enabling any available two-factor authentication features, and notifying us immediately at [email protected] if you suspect your account has been compromised.

As a Player on the bara22 Platform, you hold the following rights in respect of your Personal Data. These rights may be subject to certain conditions or limitations where they conflict with our legal obligations or the rights of other individuals.

To exercise any of the above rights, please send a written request to [email protected] with the subject line "Data Rights Request — [Your Registered Name]". We will verify your identity before processing any request and will respond within thirty (30) calendar days. Complex requests may require up to an additional sixty (60) days, in which case we will notify you of the extension and the reasons for it.

The bara22 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, store, or process Personal Data relating to any person under the age of 21. Registration on the Platform by persons under 21 is expressly prohibited and constitutes a breach of our Terms and Conditions.

If you are a parent or guardian and believe that a minor in your care has registered on the bara22 Platform or provided us with their Personal Data, please contact us immediately at [email protected]. We will take prompt action to verify the account, suspend access where appropriate, and securely delete any Personal Data belonging to a minor upon confirmation.

Parents and guardians are encouraged to use reputable parental-control software to restrict minors' access to online gambling platforms. bara22 supports responsible gaming initiatives and takes underage access extremely seriously.

The bara22 Platform may display references to third-party payment providers, game studios, or external services as part of our product delivery. This Privacy Policy applies only to the bara22 Platform and does not extend to any third-party websites, applications, or services that you access in connection with your use of bara22.

When you interact with a third-party service — for example, authenticating your GoPay or OVO account through that provider's interface — you are subject to that provider's own privacy policy and terms of service. bara22 has no control over, and assumes no responsibility for, the data practices of third-party providers. We recommend that you review the privacy policies of all third-party services you use in connection with your bara22 account.

bara22 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, technology, legal obligations, or Platform features. When we make material changes, we will notify registered Players via the email address associated with their account at least fourteen (14) days before the changes take effect, where practicable.

The "Last Updated" date at the top of this page will be revised with each substantive amendment. We encourage you to review this Privacy Policy periodically to stay informed about how we handle your Personal Data. Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acceptance of the amended terms.

If you object to any amendment, you may contact us to request account closure in accordance with our Terms and Conditions. Your right to request deletion of your Personal Data (subject to applicable retention obligations) remains unaffected by any policy amendment.

For all privacy-related inquiries, data rights requests, or concerns about how bara22 handles your Personal Data, please contact our privacy team using the details below. Our Indonesian-speaking support agents are available around the clock to assist you.

• Privacy Email: [email protected]
• Subject Line Format: "Privacy Request — [Your Registered Name]" for data rights requests; "Privacy Inquiry — [Topic]" for general questions.
• Response Time: Acknowledgment within five (5) business days; full response within thirty (30) calendar days for standard requests.
• Support Hours: 24 hours a day, 7 days a week (including Indonesian public holidays such as Idul Fitri, Indonesian Independence Day, and Nyepi).

For questions about our responsible gaming tools, deposit limits, or self-exclusion options, please visit our Responsible Gaming page. For general account and betting queries, our FAQ page covers the most common topics in full.